Clerk is the best drop-in for React.
If you're building a React or Next.js app and need auth
working this afternoon, Clerk is genuinely unbeatable.
<SignIn />, <UserButton />,
done. This page isn't an argument to replace that.
It's about the moment when "we ship React auth" stops being
the hard problem and "we sell to enterprise customers who
demand SAML SSO and SCIM provisioning" starts being it.
Stay on Clerk if …
Being straight about where they're the better call.
You're React / Next.js and under 50 000 users
Clerk's free tier covers up to 50 000 monthly retained users. For a B2C React app in its first two years, that's usually the whole journey. The developer experience is exceptional and there's no reason to switch until you hit a concrete wall.
The login UI is a core differentiator
Clerk's hosted login components and user profile widgets are the cleanest in the market. If your team values not owning the login UI at all — and you're willing to accept vendor-specific wrappers in your React tree — Clerk wins.
You don't need SAML IdP, SCIM, PKI, or self-host
If your requirements are "sign-in and session management for a consumer app," Clerk does that cleanly. Evaluating platforms by features you don't need is how teams end up with overpriced identity stacks.
The four moments you outgrow Clerk
Every Clerk customer who moves to WeldForge tells us it was one of these.
"Our buyer requires SAML SSO"
Your first serious B2B customer audit asks for SAML 2.0 SSO against their Okta tenant. Clerk supports SAML only on their Enterprise tier (custom pricing). WeldForge's SAML IdP is in every paid tier from $29/mo — you ship the compliance answer instead of calling sales.
"Our buyer wants Okta to provision users"
Same customer, same audit, next question: "Can Okta push our users into your app via SCIM?" Again, Clerk Enterprise only. Same $29/mo WeldForge tier ships full SCIM 2.0 with group-to-role binding.
"The customer won't let us run identity in third-party SaaS"
Regulated industries (banking, healthcare, government) routinely refuse to accept third-party-hosted auth for their users. Clerk has no self-host story. WeldForge's Self-Host Supported tier ($249/mo) is exactly this.
Where the price crossover actually is
Clerk's overage above its 50 000 included users ($0.02 each) makes it about $1 025/mo at 100 000, against $1 699/mo for WeldForge Cloud Business plus overage — so Clerk is still ahead there. On hosted price the crossover is further out, near 250 000. Self-hosted, the comparison is $0 at every one of these tiers.
Pricing at common MAU tiers
Clerk's free tier is genuinely generous, and it got more so. Re-checked against clerk.com/pricing on 14 September 2026: the included allowance is now 50,000 monthly retained users, not the 10,000 an earlier version of this page compared against. Clerk wins on price outright up to that line, and this table has been corrected to say so.
Note the unit. Clerk bills MRU — a user who returns at least one day after signing up — not MAU. For an app with heavy one-visit signups, MRU is the smaller number, so Clerk is cheaper than a like-for-like MAU reading suggests.
| Monthly Active Users | WeldForge | Clerk | Winner on price |
|---|---|---|---|
| 500 | $0 self-hosted | $0 Hobby | Tie |
| 1 000 | $0 self-hosted / $29 hosted | $0 Hobby | Tie self-hosted, Clerk vs our hosted |
| 10 000 | $0 self-hosted / $149 hosted | $0 Hobby | Tie self-hosted, Clerk vs our hosted |
| 25 000 | $0 self-hosted / $524 hosted | $0 Hobby | Tie self-hosted, Clerk vs our hosted |
| 50 000 | $0 self-hosted / $699 hosted | $0 top of the included allowance | Tie self-hosted, Clerk vs our hosted |
| 100 000 | $0 self-hosted / $1 699 hosted | ~$1 025 Pro $25 + 50k overage at $0.02 | Clerk on hosted price |
| 250 000 | $0 self-hosted / $2 499 Cloud Scale | ~$3 725 Pro + tiered overage ($0.02 to 100k, $0.018 above) | WeldForge |
Feature-for-feature
| Capability | Clerk Pro ($25/mo) | WeldForge Cloud Team ($149/mo) |
|---|---|---|
| OAuth 2.0 / OpenID Connect | ✓ | ✓ |
| Drop-in React / Next.js components | ✓ best in class | — backend-only, you build the UI |
| MFA — TOTP / passkeys / SMS | ✓ | ✓ |
| Social logins | ✓ | ✓ |
| User profile widget | ✓ hosted | — you build or use the admin portal |
| Organisations / B2B multi-tenancy | ✓ Pro tier | ✓ tenant-scoped from DB up |
| SAML 2.0 Identity Provider | Enterprise tier only | ✓ |
| SAML 2.0 Service Provider (upstream IdP federation) | Enterprise tier only | ✓ |
| SCIM 2.0 inbound provisioning | Enterprise tier only | ✓ |
| LDAP / Active Directory upstream | — | ✓ |
| Internal PKI (CA / CRL / OCSP) | — | ✓ |
| HMAC-signed audit webhooks | Pro tier (basic) | ✓ with retry + DLQ |
| Scoped API keys (path + method) | — | ✓ |
| Service-account tokens | JWT-only M2M | ✓ |
| Self-host | — | ✓ Developer (free) + Self-Host Supported |
| Source-available | — | ✓ |
| POPIA-native data residency | US / EU only | ✓ Cape Town region |
| Custom domains | Pro tier | ✓ |
The short version: Clerk's strength is the pre-built React UI and their generous free tier. WeldForge's strength is backend-identity breadth — every protocol enterprise buyers ask for is in the base paid tier, plus a self-host path and ZA residency.
Migrating from Clerk
Clerk's export API makes user migration straightforward; the bigger lift is replacing the React components.
Step 1 — Export users from Clerk
curl https://api.clerk.com/v1/users?limit=500 \
-H "Authorization: Bearer $CLERK_SECRET_KEY" \
> clerk-users.json
Clerk exports email, phone, external IDs, metadata and hashed passwords (bcrypt / scrypt). WeldForge accepts these natively.
Step 2 — Export organisations and memberships
If you use Clerk Organisations, export them with the members endpoint:
curl https://api.clerk.com/v1/organizations \
-H "Authorization: Bearer $CLERK_SECRET_KEY" \
> clerk-organisations.json
Step 3 — Import into WeldForge
curl -X POST $HOST/api/admin/migrate/clerk \
-H "x-app-authorization: $TOKEN" \
-H "Content-Type: application/json" \
--data-binary @clerk-users.json
Clerk organisations map to WeldForge tenants or to a single tenant's SCIM groups — you choose during import based on your B2B model.
Step 4 — Swap the React integration
This is the part that differs from the Keycloak / Auth0 / FusionAuth
migrations: Clerk's SDKs deeply integrate React rendering.
Replacing <SignIn /> with a bring-your-own-UI
OIDC flow is real work — typically 2–5 days for a
mature app. The tradeoff is you no longer have vendor-specific
components in your tree.
// Before (Clerk)
import { SignIn } from '@clerk/nextjs';
export default function Page() { return <SignIn />; }
// After (standard OIDC, e.g. next-auth or oidc-client-ts)
// Redirect to /t/acme/oauth2/authorize?client_id=... on click.
FAQ
Why would I give up Clerk's React components?
Because they're a lock-in surface. Clerk components assume Clerk's session model, Clerk's user shape, Clerk's organisations API. If you want portability or you're tired of a vendor-shaped hole in your React tree, you build a lightweight sign-in yourself on top of standard OIDC.
Does WeldForge have pre-built components?
Not React-branded ones, no. We intentionally stop at the protocol boundary — `oidc-client-ts`, `next-auth`, `@auth0/auth0-react` and every other OIDC client library works against WeldForge out of the box. You own the UI.
Is Clerk really cheaper below 30k MAU?
Yes, and we're not going to pretend otherwise. Their included allowance — 50 000 monthly retained users as of September 2026 — is unusually generous, and above it the $25 base plus $0.02 per user is structurally cheaper than our Cloud Team $149 plus $0.025. On hosted price alone Clerk stays ahead until roughly 250 000 users. The reasons to choose WeldForge before then are not price: enterprise SAML and SCIM without a per-connection fee, self-hosting for data residency, and a per-tenant SAML IdP. If none of those apply to you, Clerk is a good answer and we would rather you heard that here than found it out after migrating.
What about Clerk Organisations?
Clerk Organisations map to WeldForge's tenants (one-to-one) or to SCIM groups inside a single tenant, depending on your B2B shape. The migration tool will ask.
Will Clerk's passkey credentials carry over?
WebAuthn credentials are tied to the relying party. Passkeys registered against Clerk cannot be re-used against WeldForge — users will re-enrol on first login. Not a blocker; a one-time friction point.